This is an automated email from the ASF dual-hosted git repository.
markt-asf pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/tomcat-native.git
The following commit(s) were added to refs/heads/main by this push:
new fb688de41 Keep connection and context verification settings separate
fb688de41 is described below
commit fb688de41e837d98e76961e44584b37989e4f7d0
Author: Mark Thomas <[email protected]>
AuthorDate: Thu Aug 27 15:51:54 2026 +0100
Keep connection and context verification settings separate
---
native/include/ssl_private.h | 9 +++++++--
native/src/ssl.c | 37 +++++++++++++++----------------------
native/src/sslcontext.c | 11 +++++++----
native/src/sslutils.c | 12 +++++++++---
xdocs/miscellaneous/changelog.xml | 5 +++++
5 files changed, 43 insertions(+), 31 deletions(-)
diff --git a/native/include/ssl_private.h b/native/include/ssl_private.h
index 5df47a92e..514890d6f 100644
--- a/native/include/ssl_private.h
+++ b/native/include/ssl_private.h
@@ -183,6 +183,8 @@ struct tcn_ssl_ctxt_t {
/* for client or downstream server authentication */
int verify_depth;
int verify_mode;
+
+ /* Password callback */
tcn_pass_cb_t *cb_data;
/* for client: List of protocols to request via ALPN.
@@ -218,8 +220,11 @@ struct tcn_ssl_conf_ctxt_t {
#endif
typedef struct {
- apr_pool_t *pool;
- tcn_ssl_ctxt_t *ctx;
+ apr_pool_t *pool;
+ tcn_ssl_ctxt_t *ctx;
+ /* for client or downstream server authentication */
+ int verify_depth;
+ int verify_mode;
enum {
PHA_NONE = 0, /* Before PHA */
PHA_STARTED, /* PHA req sent to client but no response */
diff --git a/native/src/ssl.c b/native/src/ssl.c
index 6e0973733..3391cccf5 100644
--- a/native/src/ssl.c
+++ b/native/src/ssl.c
@@ -349,6 +349,8 @@ TCN_IMPLEMENT_CALL(jlong /* SSL * */, SSL,
newSSL)(TCN_STDARGS,
}
con->pool = p;
con->ctx = c;
+ con->verify_mode = SSL_CVERIFY_UNSET;
+ con->verify_depth = c->verify_depth;
/* Store the handshakeCount in the SSL instance. */
*handshakeCount = 0;
@@ -798,41 +800,32 @@ TCN_IMPLEMENT_CALL(jlong, SSL, getTime)(TCN_STDARGS,
jlong ssl)
}
}
-TCN_IMPLEMENT_CALL(void, SSL, setVerify)(TCN_STDARGS, jlong ssl,
- jint level, jint depth)
+TCN_IMPLEMENT_CALL(void, SSL, setVerify)(TCN_STDARGS, jlong ssl, jint level,
jint depth)
{
- tcn_ssl_ctxt_t *c;
- int verify;
SSL *ssl_ = J2P(ssl, SSL *);
+ int verify = SSL_VERIFY_NONE;
+ UNREFERENCED(o);
if (ssl_ == NULL) {
- tcn_ThrowException(e, "ssl is null");
+ tcn_ThrowException(e, "SSL is null");
return;
}
- c = SSL_get_app_data2(ssl_);
-
- verify = SSL_VERIFY_NONE;
-
- UNREFERENCED(o);
+ tcn_ssl_conn_t *con = SSL_get_app_data(ssl_);
- if (c == NULL) {
- tcn_ThrowException(e, "context is null");
- return;
- }
- c->verify_mode = level;
+ con->verify_mode = level;
- if (c->verify_mode == SSL_CVERIFY_UNSET)
- c->verify_mode = SSL_CVERIFY_NONE;
+ if (con->verify_mode == SSL_CVERIFY_UNSET)
+ con->verify_mode = SSL_CVERIFY_NONE;
if (depth > 0)
- c->verify_depth = depth;
+ con->verify_depth = depth;
/*
- * Configure callbacks for SSL context
+ * Configure callbacks for SSL
*/
- if (c->verify_mode == SSL_CVERIFY_REQUIRE)
+ if (con->verify_mode == SSL_CVERIFY_REQUIRE)
verify |= SSL_VERIFY_PEER_STRICT;
- if ((c->verify_mode == SSL_CVERIFY_OPTIONAL) ||
- (c->verify_mode == SSL_CVERIFY_OPTIONAL_NO_CA))
+ if ((con->verify_mode == SSL_CVERIFY_OPTIONAL) ||
+ (con->verify_mode == SSL_CVERIFY_OPTIONAL_NO_CA))
verify |= SSL_VERIFY_PEER;
SSL_set_verify(ssl_, verify, SSL_callback_SSL_verify);
diff --git a/native/src/sslcontext.c b/native/src/sslcontext.c
index dd2337eb0..9c968d5f8 100644
--- a/native/src/sslcontext.c
+++ b/native/src/sslcontext.c
@@ -557,14 +557,17 @@ cleanup:
return rv;
}
-TCN_IMPLEMENT_CALL(void, SSLContext, setVerify)(TCN_STDARGS, jlong ctx,
- jint level, jint depth)
+TCN_IMPLEMENT_CALL(void, SSLContext, setVerify)(TCN_STDARGS, jlong ctx, jint
level, jint depth)
{
tcn_ssl_ctxt_t *c = J2P(ctx, tcn_ssl_ctxt_t *);
int verify = SSL_VERIFY_NONE;
-
UNREFERENCED(o);
- TCN_ASSERT(ctx != 0);
+
+ if (c == NULL) {
+ tcn_ThrowException(e, "SSLContext is null");
+ return;
+ }
+
c->verify_mode = level;
if (c->verify_mode == SSL_CVERIFY_UNSET)
diff --git a/native/src/sslutils.c b/native/src/sslutils.c
index 6f22cb912..b7dc71835 100644
--- a/native/src/sslutils.c
+++ b/native/src/sslutils.c
@@ -298,10 +298,10 @@ int SSL_CTX_use_certificate_chain(SSL_CTX *ctx, const
char *file,
int SSL_callback_SSL_verify(int ok, X509_STORE_CTX *ctx)
{
/* Get Apache context back through OpenSSL context */
- SSL *ssl = X509_STORE_CTX_get_ex_data(ctx,
-
SSL_get_ex_data_X509_STORE_CTX_idx());
+ SSL *ssl = X509_STORE_CTX_get_ex_data(ctx,
SSL_get_ex_data_X509_STORE_CTX_idx());
tcn_ssl_conn_t *con = (tcn_ssl_conn_t *)SSL_get_app_data(ssl);
- /* Get verify ingredients */
+
+ /* Set verify defaults from SSL Context */
int errnum = X509_STORE_CTX_get_error(ctx);
int errdepth = X509_STORE_CTX_get_error_depth(ctx);
int verify = con->ctx->verify_mode;
@@ -311,6 +311,12 @@ int SSL_callback_SSL_verify(int ok, X509_STORE_CTX *ctx)
int ocsp_timeout = con->ctx->ocsp_timeout;
int ocsp_verify_flags = con->ctx->ocsp_verify_flags;
+ /* Check for SSL specific configuration */
+ if (con->verify_mode != SSL_CVERIFY_UNSET) {
+ verify = con->verify_mode;
+ depth = con->verify_depth;
+ }
+
#if defined(SSL_OP_NO_TLSv1_3)
con->pha_state = PHA_COMPLETE;
#endif
diff --git a/xdocs/miscellaneous/changelog.xml
b/xdocs/miscellaneous/changelog.xml
index a728f60d4..02c59e72f 100644
--- a/xdocs/miscellaneous/changelog.xml
+++ b/xdocs/miscellaneous/changelog.xml
@@ -64,6 +64,11 @@
<scode>
Remove unused code. (markt)
</scode>
+ <fix>
+ Ensure that per connection changes to certificate verification settings,
+ e.g. to support client certificate authentication, do not modify the
+ certificate verification settings for other connections. (markt)
+ </fix>
</changelog>
</section>
<section name="2.0.15" rtext="2026-06-15">
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
